Firewall Rule Generator — v4.1.1

Generate Linux, macOS, and Windows firewall scripts. Everything runs client side.

Use the blue buttons or the dropdown below.

Platform Target OS:

Generating Linux scripts. Switch to macOS or Windows for their native outputs.

macOS uses Packet Filter (pf). This generator creates an anchor-based ruleset and safe commands to validate, load, and enable pf.

Windows Output Engine:

PowerShell is clearer and easier to maintain. netsh helps with older workflows and GPO copy paste.

General Firewall: Role:

Services / Ports

Pick services you want to allow (TCP unless noted)

SSH (22) HTTP (80) HTTPS (443) DNS (udp 53) Dev (3000) Dev (5000) Docker (special handling)

Admin / IP

Exempt an admin IP so you do not lock yourself out

Detect my public IP Auto detect Manual

Country Blocking

Select countries to block. Country blocking uses ipset for iptables and native sets for nftables. UFW will skip this feature.

Countries (multi select):

Attempt IPv6 lists too

IPv6 lists may not be available for all providers. The generator will skip gracefully.

Profile

Import Profile

Profiles save OS, engine, firewall type, role, services, countries, IP mode.

Visual Preview

Quick Tips

Always exempt an admin IP before applying DROP policies.
Test first on a non critical machine or VM.
For cloud servers, use the provider console if you get locked out.
nftables is recommended for new Linux systems. iptables compatibility is still common.
On macOS, validate with pfctl -n before loading.
On Windows PowerShell, run as Administrator.

Legal Disclaimer

This tool is for educational and informational use only. Generated scripts may alter network access or lock you out of your systems. Always review and test outputs in a safe environment. The author and host accept no liability for damage, data loss, or misuse. Do not run generated scripts without understanding them.